warden.rn 1.0.0

package/README.MD

@@ -0,0 +1,13 @@
+# RN应用三方代码权限管理工具
+## 引入形式
+作为Metro构建工具的自定义Serializer引入，在metro.config.js中引入
+如果有多个serializer，需要将WardenSerializer置于最外层
+```js
+  serializer: {
+    customSerializer: createWardenSerializer(createSentryMetroSerializer(), {
+      // ... 配置项
+    }),
+  },
+```
+## 配置
+

package/dist/build/deps.d.ts

@@ -0,0 +1,4 @@
+import { NodePath } from "@babel/traverse";
+import * as t from "@babel/types";
+export declare function protectRequire(fn: NodePath<t.FunctionExpression>, deps: number[]): void;
+//# sourceMappingURL=deps.d.ts.map

package/dist/build/deps.js

@@ -0,0 +1,50 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.protectRequire = protectRequire;
+const parser_1 = require("@babel/parser");
+const t = require("@babel/types");
+function protectRequire(fn, deps) {
+    const require = fn.node.params[1];
+    if (!t.isIdentifier(require)) {
+        throw new Error(`require must be an identifier`);
+        return;
+    }
+    const importDefault = fn.node.params[2];
+    if (!t.isIdentifier(importDefault)) {
+        throw new Error(`importDefault must be an identifier`);
+        return;
+    }
+    const importAll = fn.node.params[3];
+    if (!t.isIdentifier(importAll)) {
+        throw new Error(`importAll must be an identifier`);
+        return;
+    }
+    const template = `
+() => {
+    const __r0 = ${JSON.stringify(deps)};
+    const __r1 = ${require.name};
+    const __r2 = ${importDefault.name};
+    const __r3 = ${importAll.name};
+    ${require.name} = function(i) {
+        if (__r0.includes(i)) {
+            return __r1(i);
+        }
+    };
+    ${importDefault.name} = function(i) {
+        if (__r0.includes(i)) {
+            return __r2(i);
+        }
+    };
+    ${importAll.name} = function(i) {
+        if (__r0.includes(i)) {
+            return __r3(i);
+        }
+    };
+    ${require.name}.importDefault = __r2;
+    ${require.name}.importAll = __r3;
+}
+    `;
+    const ppFn = (0, parser_1.parseExpression)(template);
+    fn.node.body.body.unshift(t.expressionStatement(t.callExpression(ppFn, [])));
+}
+//# sourceMappingURL=deps.js.map

package/dist/build/globals.d.ts

@@ -0,0 +1,6 @@
+import * as t from "@babel/types";
+import { NodePath } from "@babel/traverse";
+export declare function refactorRuntime(file: t.File, id2path?: Record<number, string>, dev?: boolean): void;
+export declare function analyzeGlobals(ast: NodePath<t.CallExpression>, normalize?: boolean): Record<string, "r" | "rw">;
+export declare function hardenGlobals(ast: NodePath<t.CallExpression>, globals: Record<string, "r" | "rw">, moduleId: number, dev?: boolean): void;
+//# sourceMappingURL=globals.d.ts.map

package/dist/build/globals.js

@@ -0,0 +1,419 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.refactorRuntime = refactorRuntime;
+exports.analyzeGlobals = analyzeGlobals;
+exports.hardenGlobals = hardenGlobals;
+const t = require("@babel/types");
+const parser_1 = require("@babel/parser");
+const ECMAGlobals = [
+    "AggregateError",
+    "Array",
+    "ArrayBuffer",
+    "Atomics",
+    "BigInt",
+    "BigInt64Array",
+    "BigUint64Array",
+    "Boolean",
+    "DataView",
+    "Date",
+    "Error",
+    "EvalError",
+    "FinalizationRegistry",
+    "Float16Array",
+    "Float32Array",
+    "Float64Array",
+    "Function",
+    "Infinity",
+    "Int16Array",
+    "Int32Array",
+    "Int8Array",
+    "Intl",
+    "Iterator",
+    "JSON",
+    "Map",
+    "Math",
+    "NaN",
+    "Number",
+    "Object",
+    "Promise",
+    "Proxy",
+    "RangeError",
+    "ReferenceError",
+    "Reflect",
+    "RegExp",
+    "Set",
+    "SharedArrayBuffer",
+    "String",
+    "Symbol",
+    "SyntaxError",
+    "TypeError",
+    "Uint16Array",
+    "Uint32Array",
+    "Uint8Array",
+    "Uint8ClampedArray",
+    "URIError",
+    "WeakMap",
+    "WeakRef",
+    "WeakSet",
+    "decodeURI",
+    "decodeURIComponent",
+    "encodeURI",
+    "encodeURIComponent",
+    "escape",
+    // "eval",
+    "globalThis",
+    "isFinite",
+    "isNaN",
+    "parseFloat",
+    "parseInt",
+    "undefined",
+    "unescape",
+];
+class GVPool {
+    globals = Object.create(null);
+    add(name, perm) {
+        // 不管控除eval以外的ECMA全局变量的读权限
+        if (ECMAGlobals.includes(name) && perm === "r") {
+            return;
+        }
+        if (name in this.globals) {
+            if (perm === "rw") {
+                this.globals[name] = "rw";
+            }
+        }
+        else {
+            this.globals[name] = perm;
+        }
+    }
+}
+function __mkGb(g, fg, moduleId, dev = false) {
+    if (dev) {
+        //@ts-expect-error
+        if (globalThis.__warden_globals == null) {
+            //@ts-expect-error
+            globalThis.__warden_globals = Object.create(null);
+        }
+        //@ts-expect-error
+        if (globalThis.__warden_globals[moduleId] == null) {
+            //@ts-expect-error
+            globalThis.__warden_globals[moduleId] = Object.create(null);
+        }
+    }
+    const ECMAGlobals = [
+        "AggregateError",
+        "Array",
+        "ArrayBuffer",
+        "Atomics",
+        "BigInt",
+        "BigInt64Array",
+        "BigUint64Array",
+        "Boolean",
+        "DataView",
+        "Date",
+        "Error",
+        "EvalError",
+        "FinalizationRegistry",
+        "Float16Array",
+        "Float32Array",
+        "Float64Array",
+        "Function",
+        "Infinity",
+        "Int16Array",
+        "Int32Array",
+        "Int8Array",
+        "Intl",
+        "Iterator",
+        "JSON",
+        "Map",
+        "Math",
+        "NaN",
+        "Number",
+        "Object",
+        "Promise",
+        "Proxy",
+        "RangeError",
+        "ReferenceError",
+        "Reflect",
+        "RegExp",
+        "Set",
+        "SharedArrayBuffer",
+        "String",
+        "Symbol",
+        "SyntaxError",
+        "TypeError",
+        "Uint16Array",
+        "Uint32Array",
+        "Uint8Array",
+        "Uint8ClampedArray",
+        "URIError",
+        "WeakMap",
+        "WeakRef",
+        "WeakSet",
+        "decodeURI",
+        "decodeURIComponent",
+        "encodeURI",
+        "encodeURIComponent",
+        "escape",
+        // "eval",
+        "globalThis",
+        "isFinite",
+        "isNaN",
+        "parseFloat",
+        "parseInt",
+        "undefined",
+        "unescape",
+    ];
+    const np = new Proxy(fg != null ? fg : globalThis, {
+        get(t, p, r) {
+            if (typeof p === "symbol") {
+                return Reflect.get(t, p, t);
+            }
+            if (["globalThis", "self", "window", "global"].includes(p)) {
+                return t;
+            }
+            if (p in g || ECMAGlobals.includes(p)) {
+                return Reflect.get(t, p, t);
+            }
+            if (dev) {
+                //@ts-expect-error
+                if (!(p in globalThis.__warden_globals[moduleId])) {
+                    //@ts-expect-error
+                    globalThis.__warden_globals[moduleId][p] = "r";
+                }
+                return Reflect.get(t, p, t);
+            }
+            return undefined;
+        },
+        has(t, p) {
+            if (typeof p === "symbol") {
+                return Reflect.has(t, p);
+            }
+            if (p in g || ECMAGlobals.includes(p)) {
+                return Reflect.has(t, p);
+            }
+            if (dev) {
+                //@ts-expect-error
+                if (!(p in globalThis.__warden_globals[moduleId])) {
+                    //@ts-expect-error
+                    globalThis.__warden_globals[moduleId][p] = "r";
+                }
+                return Reflect.has(t, p);
+            }
+            return false;
+        },
+        set(t, p, n, r) {
+            if (typeof p === "symbol") {
+                return Reflect.set(t, p, n, t);
+            }
+            if (p in g) {
+                return Reflect.set(t, p, n, t);
+            }
+            if (dev) {
+                //@ts-expect-error
+                if (!(p in globalThis.__warden_globals)) {
+                    //@ts-expect-error
+                    globalThis.__warden_globals[moduleId][p] = "rw";
+                }
+                return Reflect.set(t, p, n, t);
+            }
+            return false;
+        },
+        getOwnPropertyDescriptor(t, p) {
+            if (typeof p === "symbol") {
+                return Reflect.getOwnPropertyDescriptor(t, p);
+            }
+            if (p in g || ECMAGlobals.includes(p)) {
+                return Reflect.getOwnPropertyDescriptor(t, p);
+            }
+            if (dev) {
+                //@ts-expect-error
+                if (!(p in globalThis.__warden_globals)) {
+                    //@ts-expect-error
+                    globalThis.__warden_globals[moduleId][p] = "r";
+                }
+                return Reflect.getOwnPropertyDescriptor(t, p);
+            }
+            return undefined;
+        },
+        defineProperty(t, p, d) {
+            if (typeof p === "symbol") {
+                return Reflect.defineProperty(t, p, d);
+            }
+            if (p in g) {
+                return Reflect.defineProperty(t, p, d);
+            }
+            if (dev) {
+                //@ts-expect-error
+                if (!(p in globalThis.__warden_globals[moduleId])) {
+                    //@ts-expect-error
+                    globalThis.__warden_globals[moduleId][p] = "rw";
+                }
+                return Reflect.defineProperty(t, p, d);
+            }
+            return false;
+        },
+        deleteProperty(t, p) {
+            if (typeof p === "symbol") {
+                return Reflect.deleteProperty(t, p);
+            }
+            if (p in g) {
+                return Reflect.deleteProperty(t, p);
+            }
+            if (dev) {
+                //@ts-expect-error
+                if (!(p in globalThis.__warden_globals[moduleId])) {
+                    //@ts-expect-error
+                    globalThis.__warden_globals[moduleId][p] = "rw";
+                }
+                return Reflect.deleteProperty(t, p);
+            }
+            return false;
+        },
+    });
+    return np;
+}
+function refactorRuntime(file, id2path = {}, dev = false) {
+    const debugGb = (id2Path) => {
+        const result = Object.create(null);
+        for (const [id, gb] of Object.entries(globalThis.__warden_globals)) {
+            if (Object.keys(gb).length === 0) {
+                continue;
+            }
+            const path = id2Path[id];
+            result[path] = gb;
+        }
+        return result;
+    };
+    if (dev) {
+        file.program.body.unshift(t.expressionStatement(t.assignmentExpression("=", t.memberExpression(t.identifier("globalThis"), t.identifier("__debugGb")), (0, parser_1.parseExpression)(`(${debugGb.toString()}).bind(null, ${JSON.stringify(id2path)})`))));
+    }
+    file.program.body.unshift(t.expressionStatement(t.assignmentExpression("=", t.memberExpression(t.identifier("globalThis"), t.identifier("__mkGb")), (0, parser_1.parseExpression)(__mkGb.toString()))));
+}
+function analyzeGlobals(ast, normalize = false) {
+    const pool = new GVPool();
+    const fn = ast.get("arguments")[0];
+    const globalAlias = ["globalThis", "self", "window", "g", "global"];
+    fn.traverse({
+        MemberExpression(path) {
+            let expr = [];
+            let node = path.node;
+            let flag = true;
+            while (t.isMemberExpression(node)) {
+                if (t.isIdentifier(node.property) && !node.computed) {
+                    expr.unshift(node.property.name);
+                }
+                else if (t.isStringLiteral(node.property)) {
+                    expr.unshift(node.property.value);
+                }
+                else {
+                    flag = false;
+                    break;
+                }
+                if (t.isIdentifier(node.object)) {
+                    expr.unshift(node.object.name);
+                    break;
+                }
+                else if (t.isMemberExpression(node.object)) {
+                    node = node.object;
+                }
+                else {
+                    flag = false;
+                    break;
+                }
+            }
+            if (!flag) {
+                return;
+            }
+            let mustBeGlobal = false;
+            while (expr.length > 0 && globalAlias.includes(expr[0])) {
+                expr = expr.slice(1);
+                // 如果是globalThis/self/window开头的, 则一定是全局变量
+                mustBeGlobal = true;
+            }
+            if (expr.length > 0 &&
+                (mustBeGlobal ||
+                    !path.scope.hasBinding(expr[0], { noGlobals: true })) &&
+                expr[0] !== "arguments") {
+                pool.add(expr[0], t.isAssignmentExpression(path.parent) &&
+                    path.parent.left === path.node &&
+                    expr.length === 1
+                    ? "rw"
+                    : "r");
+            }
+            path.skip();
+        },
+        Identifier(path) {
+            if (!path.scope.hasBinding(path.node.name, { noGlobals: true })) {
+                // 排除一些不算真正变量读取的场景
+                if ((t.isMemberExpression(path.parent) ||
+                    t.isOptionalMemberExpression(path.parent)) &&
+                    path.parent.property === path.node) {
+                    return;
+                }
+                else if (t.isObjectProperty(path.parent) &&
+                    path.parent.key === path.node) {
+                    return;
+                }
+                else if ((t.isLabeledStatement(path.parent) ||
+                    t.isBreakStatement(path.parent) ||
+                    t.isContinueStatement(path.parent)) &&
+                    path.parent.label === path.node) {
+                    return;
+                }
+                else if ((t.isFunctionDeclaration(path.parent) ||
+                    t.isFunctionExpression(path.parent)) &&
+                    path.parent.id === path.node) {
+                    return;
+                }
+                else if (t.isCatchClause(path.parent) &&
+                    path.parent.param === path.node) {
+                    return;
+                }
+                else if (t.isFunction(path.parent) &&
+                    (path.parent.params.includes(path.node) ||
+                        path.parent.id === path.node ||
+                        path.parent.kind === path.node.name ||
+                        path.parent.key === path.node)) {
+                    return;
+                }
+                else if (t.isMetaProperty(path.parent)) {
+                    return;
+                }
+                else if (t.isClassProperty(path.parent) &&
+                    path.parent.key === path.node) {
+                    return;
+                    // globalAlias默认可访问
+                }
+                else if (globalAlias.includes(path.node.name)) {
+                    return;
+                }
+                else if (path.node.name === "arguments") {
+                    return;
+                }
+                pool.add(path.node.name, t.isAssignmentExpression(path.parent) &&
+                    path.parent.left === path.node
+                    ? "rw"
+                    : "r");
+                if (normalize && !ECMAGlobals.includes(path.node.name)) {
+                    path.replaceWith(t.memberExpression(t.identifier("self"), path.node, false));
+                    path.skip();
+                }
+            }
+        },
+    });
+    return pool.globals;
+}
+function hardenGlobals(ast, globals, moduleId, dev = false) {
+    const fn = ast.get("arguments")[0];
+    const id = fn.node.params[0];
+    if (!t.isIdentifier(id)) {
+        throw new Error("The first parameter of the function must be an identifier");
+    }
+    fn.node.body.body.unshift(t.variableDeclaration("var", [
+        t.variableDeclarator(t.identifier("global"), (0, parser_1.parseExpression)(`__mkGb(Object.assign(Object.create(null), ${JSON.stringify(globals)}), ${id.name}, ${moduleId}, ${dev})`)),
+        t.variableDeclarator(t.identifier("globalThis"), t.identifier("global")),
+        t.variableDeclarator(t.identifier("self"), t.identifier("global")),
+        t.variableDeclarator(t.identifier("window"), t.identifier("global")),
+    ]), t.expressionStatement((0, parser_1.parseExpression)(`${id.name} = global`)));
+}
+//# sourceMappingURL=globals.js.map

package/dist/build/harden.d.ts

@@ -0,0 +1,7 @@
+/**
+ * @file build/harden.ts
+ * 添加原型链保护
+ */
+import * as t from "@babel/types";
+export declare function addPrototypePollutionGuard(ast: t.File): void;
+//# sourceMappingURL=harden.d.ts.map

package/dist/build/harden.js

@@ -0,0 +1,109 @@
+"use strict";
+/**
+ * @file build/harden.ts
+ * 添加原型链保护
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.addPrototypePollutionGuard = addPrototypePollutionGuard;
+const t = require("@babel/types");
+const parser_1 = require("@babel/parser");
+function hardenPrototype() {
+    //@ts-expect-error
+    const valueArr = [];
+    //@ts-expect-error
+    globalThis.valueArr = valueArr;
+    const lock_Objects = ["Array", "Object"];
+    const skipSet = new Set(["size", "length", "name", "stack"]);
+    for (const objName of lock_Objects) {
+        //@ts-expect-error
+        const obj = globalThis[objName];
+        if (obj) {
+            Object.freeze(obj);
+            if (obj.prototype) {
+                const prototype = obj.prototype;
+                for (const k of Object.getOwnPropertyNames(prototype)) {
+                    const propKey = k;
+                    if (skipSet.has(propKey)) {
+                        continue;
+                    }
+                    const desc = Object.getOwnPropertyDescriptor(prototype, propKey);
+                    if (desc &&
+                        desc.value &&
+                        desc.writable &&
+                        desc.configurable) {
+                        const ovalue = desc.value;
+                        delete desc.value;
+                        delete desc.writable;
+                        valueArr.push(ovalue);
+                        const code = `
+                            if (this === ${objName}.prototype || this == null) {
+                                return globalThis.valueArr[${valueArr.length - 1}]
+                            } else {
+                                return Object.getPrototypeOf(this).${propKey};
+                            }`;
+                        //@ts-expect-error
+                        desc.get = new Function(code);
+                        //@ts-expect-error
+                        desc.set = new Function("v", `
+                            if (this === ${objName}.prototype) {
+                                return;
+                            } else {
+                                Object.defineProperty(this, "${propKey}", {
+                                    value: v,
+                                    writable: true,
+                                    configurable: true,
+                                    enumerable: true,
+                                });
+                            }
+                            `);
+                        desc.configurable = false;
+                        Object.defineProperty(prototype, propKey, desc);
+                    }
+                }
+            }
+        }
+    }
+    // 禁止动态代码执行
+    const blockError = () => {
+        throw new Error('Dynamic code execution is not allowed');
+    };
+    // 拦截 Function 构造函数
+    const OriginalFunction = Function;
+    const FunctionProxy = new Proxy(OriginalFunction, {
+        construct: blockError,
+        apply: blockError,
+    });
+    // 替换全局 Function
+    try {
+        Object.defineProperty(globalThis, 'Function', {
+            value: FunctionProxy,
+            writable: false,
+            configurable: false,
+        });
+    }
+    catch (e) {
+        // 如果无法替换，尝试直接赋值
+        globalThis.Function = FunctionProxy;
+    }
+    // 拦截 async function constructor
+    //@ts-expect-error
+    const asyncProto = (async function () { }).__proto__;
+    Object.defineProperty(asyncProto, 'constructor', {
+        get: blockError,
+        configurable: false,
+        enumerable: false,
+    });
+    // 拦截 generator function constructor
+    //@ts-expect-error
+    const genProto = (function* () { }).__proto__;
+    Object.defineProperty(genProto, 'constructor', {
+        get: blockError,
+        configurable: false,
+        enumerable: false,
+    });
+}
+function addPrototypePollutionGuard(ast) {
+    const hardenPrototypeAst = t.expressionStatement(t.callExpression((0, parser_1.parseExpression)(hardenPrototype.toString()), []));
+    ast.program.body.unshift(hardenPrototypeAst);
+}
+//# sourceMappingURL=harden.js.map

package/dist/index.d.ts

@@ -0,0 +1,9 @@
+import { MetroSerializer } from "./types/util";
+export type Options = {
+    dev: boolean | undefined;
+    sourceRoot: string | undefined;
+    policyDir: string | undefined;
+    rootDir: string | undefined;
+};
+export declare function createWardenSerializer(serilaizer: MetroSerializer | undefined, config: Options): MetroSerializer;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -0,0 +1,150 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createWardenSerializer = createWardenSerializer;
+const util_1 = require("./util/util");
+const bimap_1 = require("./util/bimap");
+const parser_1 = require("@babel/parser");
+const traverse_1 = require("@babel/traverse");
+const t = require("@babel/types");
+const generator_1 = require("@babel/generator");
+const remapping = require("@ampproject/remapping");
+const harden_1 = require("./build/harden");
+const config_1 = require("./util/config");
+const globals_1 = require("./build/globals");
+const node_fs_1 = require("node:fs");
+const path = require("node:path");
+const deps_1 = require("./build/deps");
+function createWardenSerializer(serilaizer = undefined, config) {
+    if (config == null) {
+        throw new Error(`please specify options`);
+    }
+    if (config.sourceRoot == null) {
+        config.sourceRoot = "./src";
+    }
+    if (config.policyDir == null) {
+        config.policyDir = "./Warden-RN";
+    }
+    if (config.dev == null) {
+        config.dev = true;
+    }
+    if (config.rootDir == null) {
+        config.rootDir = "./";
+    }
+    if (!serilaizer) {
+        serilaizer = (0, util_1.createDefaultMetroSerializer)();
+    }
+    return async (entryPoint, preModules, graph, options) => {
+        const rootDir = path.resolve(path.join(options.projectRoot, config.rootDir));
+        let sourceRoot = path.resolve(path.join(rootDir, config.sourceRoot));
+        if (!sourceRoot.endsWith(path.sep)) {
+            sourceRoot += path.sep;
+        }
+        const policyDir = path.resolve(path.join(rootDir), config.policyDir);
+        if (!(0, node_fs_1.existsSync)(policyDir)) {
+            (0, node_fs_1.mkdirSync)(policyDir);
+        }
+        const modifiedOptions = { ...options };
+        const createModuleId = options.createModuleId;
+        const moduleMap = new bimap_1.BiMap();
+        // 记录模块ID映射
+        modifiedOptions.createModuleId = (filePath) => {
+            const id = createModuleId(filePath);
+            moduleMap.set(id, filePath);
+            return id;
+        };
+        const serializerResult = serilaizer(entryPoint, preModules, graph, modifiedOptions);
+        const { code, map } = await (0, util_1.extractSerializerResult)(serializerResult);
+        if (options.dev) {
+            return { code, map };
+        }
+        const ast = (0, parser_1.parse)(code, {
+            sourceType: "module",
+        });
+        // 提取所有module信息
+        let override = undefined;
+        if ((0, node_fs_1.existsSync)(path.join(policyDir, "policy-override.json"))) {
+            console.log(`load override policy from ${path.join(policyDir, "policy-override.json")}`);
+            override = JSON.parse((0, node_fs_1.readFileSync)(path.join(policyDir, "policy-override.json"), "utf-8"));
+        }
+        const policy = new config_1.Policy(moduleMap, rootDir, override);
+        (0, traverse_1.default)(ast, {
+            Program(path) {
+                const bodyPaths = path.get("body");
+                for (const stm of bodyPaths) {
+                    const stmt = stm.node;
+                    if (t.isExpressionStatement(stmt) &&
+                        t.isCallExpression(stmt.expression) &&
+                        t.isIdentifier(stmt.expression.callee) &&
+                        stmt.expression.callee.name === "__d") {
+                        if (!t.isFunctionExpression(stmt.expression.arguments[0]) ||
+                            !t.isNumericLiteral(stmt.expression.arguments[1]) ||
+                            !t.isArrayExpression(stmt.expression.arguments[2])) {
+                            console.warn(`[-] 跳过不规则的模块定义语句 - ${JSON.stringify(stmt.loc)}`);
+                            continue;
+                        }
+                        const moduleFn = stmt.expression.arguments[0];
+                        const moduleId = stmt.expression.arguments[1].value;
+                        const moduleDeps = stmt.expression.arguments[2].elements.map((e) => e.value);
+                        const moduleName = moduleMap.getByKey(moduleId);
+                        if (moduleName == null) {
+                            throw new Error(`unknown module id ${moduleId}`);
+                        }
+                        // 如果是一方模块, 跳过不处理
+                        if (moduleName.startsWith(sourceRoot)) {
+                            continue;
+                        }
+                        const moduleDepNames = moduleDeps.map((e) => {
+                            const name = moduleMap.getByKey(e);
+                            if (name == null) {
+                                throw new Error(`unknown module id ${e}`);
+                            }
+                            return name;
+                        });
+                        const item = { deps: [], globals: {} };
+                        item.deps = moduleDepNames;
+                        item.globals = (0, globals_1.analyzeGlobals)(
+                        //@ts-expect-error
+                        stm.get("expression"), true);
+                        policy.setModulePolicy(moduleId, item);
+                        policy.loadOverride(moduleId);
+                        (0, deps_1.protectRequire)(stm
+                            .get("expression")
+                            .get("arguments")[0], moduleDeps);
+                        (0, globals_1.hardenGlobals)(stm.get("expression"), policy.getModulePolicy(moduleId).globals, moduleId, config.dev);
+                    }
+                }
+                path.stop();
+            },
+        });
+        (0, harden_1.addPrototypePollutionGuard)(ast);
+        const id2path = Object.create(null);
+        for (const [id, p] of moduleMap.entries()) {
+            id2path[id] = path.relative(rootDir, p);
+        }
+        (0, globals_1.refactorRuntime)(ast, id2path, config.dev);
+        const finalResult = await generateWithExistingMap(ast, code, JSON.parse(map));
+        (0, node_fs_1.writeFileSync)(path.join(policyDir, "policy.json"), policy.toJSON());
+        return { code: finalResult.code, map: finalResult.map };
+    };
+}
+async function generateWithExistingMap(ast, originalCode, originalMap) {
+    const hasMap = Object.keys(originalMap).length > 0;
+    // 生成新代码
+    const generated = (0, generator_1.default)(ast, {
+        sourceMaps: hasMap,
+        sourceFileName: hasMap ? "source.js" : undefined,
+    }, hasMap ? originalCode : undefined);
+    // 如果有原始 source map，需要合并
+    if (hasMap) {
+        const final = remapping([generated.map, originalMap], () => null);
+        return {
+            code: generated.code,
+            map: JSON.stringify(final),
+        };
+    }
+    return {
+        code: generated.code,
+        map: "{}",
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/util/bimap.d.ts

@@ -0,0 +1,19 @@
+export declare class BiMap<K, V> {
+    private keyToValue;
+    private valueToKey;
+    constructor(entries?: readonly (readonly [K, V])[] | null);
+    set(key: K, value: V): this;
+    getByKey(key: K): V | undefined;
+    getByValue(value: V): K | undefined;
+    deleteByKey(key: K): boolean;
+    deleteByValue(value: V): boolean;
+    hasKey(key: K): boolean;
+    hasValue(value: V): boolean;
+    clear(): void;
+    get keys(): IterableIterator<K>;
+    get values(): IterableIterator<V>;
+    get size(): number;
+    entries(): IterableIterator<[K, V]>;
+    forEach(callback: (value: V, key: K, map: BiMap<K, V>) => void, thisArg?: any): void;
+}
+//# sourceMappingURL=bimap.d.ts.map

package/dist/util/bimap.js

@@ -0,0 +1,96 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BiMap = void 0;
+class BiMap {
+    keyToValue;
+    valueToKey;
+    constructor(entries) {
+        this.keyToValue = new Map();
+        this.valueToKey = new Map();
+        if (entries) {
+            for (const [key, value] of entries) {
+                this.set(key, value);
+            }
+        }
+    }
+    // 设置键值对
+    set(key, value) {
+        // 检查键或值是否已存在
+        if (this.keyToValue.has(key)) {
+            const existingValue = this.keyToValue.get(key);
+            this.valueToKey.delete(existingValue);
+        }
+        if (this.valueToKey.has(value)) {
+            const existingKey = this.valueToKey.get(value);
+            this.keyToValue.delete(existingKey);
+        }
+        this.keyToValue.set(key, value);
+        this.valueToKey.set(value, key);
+        return this;
+    }
+    // 通过键获取值
+    getByKey(key) {
+        return this.keyToValue.get(key);
+    }
+    // 通过值获取键
+    getByValue(value) {
+        return this.valueToKey.get(value);
+    }
+    // 删除指定键的映射
+    deleteByKey(key) {
+        if (!this.keyToValue.has(key)) {
+            return false;
+        }
+        const value = this.keyToValue.get(key);
+        this.keyToValue.delete(key);
+        this.valueToKey.delete(value);
+        return true;
+    }
+    // 删除指定值的映射
+    deleteByValue(value) {
+        if (!this.valueToKey.has(value)) {
+            return false;
+        }
+        const key = this.valueToKey.get(value);
+        this.valueToKey.delete(value);
+        this.keyToValue.delete(key);
+        return true;
+    }
+    // 检查是否包含键
+    hasKey(key) {
+        return this.keyToValue.has(key);
+    }
+    // 检查是否包含值
+    hasValue(value) {
+        return this.valueToKey.has(value);
+    }
+    // 清空所有映射
+    clear() {
+        this.keyToValue.clear();
+        this.valueToKey.clear();
+    }
+    // 获取所有键
+    get keys() {
+        return this.keyToValue.keys();
+    }
+    // 获取所有值
+    get values() {
+        return this.valueToKey.keys();
+    }
+    // 获取大小
+    get size() {
+        return this.keyToValue.size;
+    }
+    // 获取所有键值对
+    entries() {
+        return this.keyToValue.entries();
+    }
+    // 遍历所有键值对
+    forEach(callback, thisArg) {
+        this.keyToValue.forEach((value, key) => {
+            callback.call(thisArg, value, key, this);
+        });
+    }
+}
+exports.BiMap = BiMap;
+//# sourceMappingURL=bimap.js.map

package/dist/util/config.d.ts

@@ -0,0 +1,18 @@
+import { BiMap } from "./bimap";
+export type PolicyItem = {
+    globals: Record<string, "r" | "rw">;
+    deps: string[];
+};
+export type OverRidePolicy = Record<string, Record<string, "r" | "rw">>;
+export declare class Policy {
+    private policy;
+    private moduleMap;
+    private rootDir;
+    private override;
+    constructor(moduleMap: BiMap<number, string>, rootDir: string, override?: OverRidePolicy | undefined);
+    getModulePolicy(moduleId: number): PolicyItem | undefined;
+    setModulePolicy(moduleId: number, policy: PolicyItem): void;
+    loadOverride(moduleId: number): void;
+    toJSON(): string;
+}
+//# sourceMappingURL=config.d.ts.map

package/dist/util/config.js

@@ -0,0 +1,59 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Policy = void 0;
+const path = require("node:path");
+class Policy {
+    policy = Object.create(null);
+    moduleMap;
+    rootDir;
+    override;
+    constructor(moduleMap, rootDir, override = undefined) {
+        this.moduleMap = moduleMap;
+        this.rootDir = rootDir;
+        this.override = override;
+    }
+    getModulePolicy(moduleId) {
+        return this.policy[moduleId];
+    }
+    setModulePolicy(moduleId, policy) {
+        this.policy[moduleId] = policy;
+    }
+    loadOverride(moduleId) {
+        if (this.override == null) {
+            return;
+        }
+        const modulePath = this.moduleMap.getByKey(moduleId);
+        if (modulePath == null) {
+            throw new Error(`unknown module id: ${moduleId}`);
+        }
+        const key = path.relative(this.rootDir, modulePath);
+        if (this.override[key] == null) {
+            return;
+        }
+        Object.assign(this.policy[moduleId].globals, this.override[key]);
+    }
+    toJSON() {
+        const newPolicy = Object.create(null);
+        const entries = Object.entries(this.policy).sort((a, b) => a[0].localeCompare(b[0]));
+        for (let [k, v] of entries) {
+            const modulePath = this.moduleMap.getByKey(parseInt(k));
+            if (modulePath == null) {
+                throw new Error(`unknown module id: ${k}`);
+            }
+            v = structuredClone(v);
+            v.deps = v.deps
+                .map((e) => path.relative(this.rootDir, e))
+                .sort((a, b) => a.localeCompare(b));
+            v.globals = Object.keys(v.globals)
+                .sort()
+                .reduce((acc, key) => {
+                acc[key] = v.globals[key];
+                return acc;
+            }, {});
+            newPolicy[path.relative(this.rootDir, modulePath)] = v;
+        }
+        return JSON.stringify(newPolicy, null, 4);
+    }
+}
+exports.Policy = Policy;
+//# sourceMappingURL=config.js.map

package/dist/util/util.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Creates the default Metro plain bundle serializer.
+ * Because Metro exports only the intermediate serializer functions, we need to
+ * assemble the final serializer ourselves. We have to work with the modules the same as Metro does
+ * to avoid unexpected changes in the final bundle.
+ *
+ * This is used when the user does not provide a custom serializer.
+ *
+ * https://github.com/facebook/metro/blob/9b85f83c9cc837d8cd897aa7723be7da5b296067/packages/metro/src/Server.js#L244-L277
+ */
+export declare const createDefaultMetroSerializer: () => (entryPoint: any, preModules: any, graph: any, options: any) => any;
+export declare function extractSerializerResult(serializerResult: any): Promise<{
+    code: any;
+    map: any;
+}>;
+//# sourceMappingURL=util.d.ts.map

package/dist/util/util.js

@@ -0,0 +1,89 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createDefaultMetroSerializer = void 0;
+exports.extractSerializerResult = extractSerializerResult;
+// eslint-disable-next-line import/no-extraneous-dependencies
+//@ts-nocheck
+const path = require("path");
+const metroPath = path.dirname(require.resolve("metro/package.json"));
+const baseJSBundlePath = path.join(metroPath, "src", "DeltaBundler", "Serializers", "baseJSBundle.js");
+const sourceMapStringPath = path.join(metroPath, "src", "DeltaBundler", "Serializers", "sourceMapString.js");
+const bundleToStringPath = path.join(metroPath, "src", "lib", "bundleToString.js");
+const baseJSBundle = require(baseJSBundlePath).default;
+// eslint-disable-next-line import/no-extraneous-dependencies
+const sourceMapString = require(sourceMapStringPath);
+// eslint-disable-next-line import/no-extraneous-dependencies
+const bundleToString = require(bundleToStringPath).default;
+/**
+ * This function ensures that modules in source maps are sorted in the same
+ * order as in a plain JS bundle.
+ *
+ * https://github.com/facebook/metro/blob/9b85f83c9cc837d8cd897aa7723be7da5b296067/packages/metro/src/Server.js#L984
+ */
+const getSortedModules = (graph, { createModuleId }) => {
+    const modules = [...graph.dependencies.values()];
+    // Sort by IDs
+    return modules.sort((a, b) => createModuleId(a.path) - createModuleId(b.path));
+};
+exports.getSortedModules = getSortedModules;
+/**
+ * Creates the default Metro plain bundle serializer.
+ * Because Metro exports only the intermediate serializer functions, we need to
+ * assemble the final serializer ourselves. We have to work with the modules the same as Metro does
+ * to avoid unexpected changes in the final bundle.
+ *
+ * This is used when the user does not provide a custom serializer.
+ *
+ * https://github.com/facebook/metro/blob/9b85f83c9cc837d8cd897aa7723be7da5b296067/packages/metro/src/Server.js#L244-L277
+ */
+const createDefaultMetroSerializer = () => {
+    return (entryPoint, preModules, graph, options) => {
+        // baseJSBundle assigns IDs to modules in a consistent order
+        let bundle = baseJSBundle(entryPoint, preModules, graph, options);
+        if (options.sentryBundleCallback && !graph.transformOptions.hot) {
+            bundle = options.sentryBundleCallback(bundle);
+        }
+        const { code } = bundleToString(bundle);
+        if (graph.transformOptions.hot) {
+            // Hot means running in dev server, sourcemaps are generated on demand
+            return code;
+        }
+        let sourceMapStringFunction;
+        if (typeof sourceMapString === "function") {
+            sourceMapStringFunction = sourceMapString;
+        }
+        else if (typeof sourceMapString === "object" &&
+            sourceMapString != null &&
+            "sourceMapString" in sourceMapString &&
+            typeof sourceMapString["sourceMapString"] === "function") {
+            sourceMapStringFunction = sourceMapString.sourceMapString;
+        }
+        else if (typeof sourceMapString?.default === "function") {
+            sourceMapStringFunction = sourceMapString.default;
+        }
+        else {
+            throw new Error(`Cannot find sourceMapString function in 'metro/src/DeltaBundler/Serializers/sourceMapString'`);
+        }
+        // Always generate source maps, can't use Sentry without source maps
+        const map = sourceMapStringFunction([...preModules, ...(0, exports.getSortedModules)(graph, options)], {
+            processModuleFilter: options.processModuleFilter,
+            shouldAddToIgnoreList: options.shouldAddToIgnoreList,
+        });
+        return { code, map };
+    };
+};
+exports.createDefaultMetroSerializer = createDefaultMetroSerializer;
+async function extractSerializerResult(serializerResult) {
+    if (typeof serializerResult === "string") {
+        return { code: serializerResult, map: "{}" };
+    }
+    if ("map" in serializerResult) {
+        return { code: serializerResult.code, map: serializerResult.map };
+    }
+    const awaitedResult = await serializerResult;
+    if (typeof awaitedResult === "string") {
+        return { code: awaitedResult, map: "{}" };
+    }
+    return { code: awaitedResult.code, map: awaitedResult.map };
+}
+//# sourceMappingURL=util.js.map

package/package.json

@@ -0,0 +1,30 @@
+{
+    "name": "warden.rn",
+    "version": "1.0.0",
+    "description": "",
+    "main": "dist/index.js",
+    "scripts": {
+        "test": "echo \"Error: no test specified\" && exit 1"
+    },
+    "files": [
+        "dist/**/*.js",
+        "dist/**/*.d.ts"
+    ],
+    "keywords": [],
+    "author": "",
+    "license": "ISC",
+    "type": "commonjs",
+    "devDependencies": {
+        "@types/babel__generator": "^7.27.0",
+        "@types/babel__traverse": "^7.28.0",
+        "@types/node": "^25.0.3",
+        "metro": "^0.83.3"
+    },
+    "dependencies": {
+        "@ampproject/remapping": "^2.3.0",
+        "@babel/generator": "^7.28.5",
+        "@babel/parser": "^7.28.5",
+        "@babel/traverse": "^7.28.5",
+        "@babel/types": "^7.28.5"
+    }
+}